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Cryptanalysis of the Hillery-Buzek-Berthiaume quantum secret-sharing protocol 
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The participant attack is the most serious threat for quantum secret-sharing protocols. We present 
a method to analyze the security of quantum secret-sharing protocols against this kind of attack 
taking the scheme of Hillery, Buzek, and Berthiaume (HBB) [Phys. Rev. A 59 1829 (1999)] as 
an example. By distinguishing between two mixed states, we derive the necessary and sufficient 
conditions under which a dishonest participant can attain all the information without introducing 
any error, which shows that the HBB protocol is insecure against dishonest participants. It is easy 
to verify that the attack scheme of Karlsson, Koashi, and Imoto [Phys. Rev. A 59, 162 (1999)] 
is a special example of our results. To demonstrate our results further, we construct an explicit 
attack scheme according to the necessary and sufficient conditions. Our work completes the security 
analysis of the HBB protocol, and the method presented may be useful for the analysis of other 
similar protocols. 

PACS numbers: 03.67.Dd, 03.67.Hk 



I. INTRODUCTION 

Quantum cryptography is a technique which permits 
parties to communicate over an open channel in a se- 
cure way. Quantum secret sharing (QSS) is an important 
branch of quantum cryptography, which allows a secret to 
be shared among many participants in such a way that 
only the authorized groups can reconstruct it. In fact, 
there are two types in quantum secret sharing, that is, 
the sharing of classical secret and that of quantum infor- 
mation. The former was first proposed by Hillery, Buzek 
and Berthiaume [l| (called HBB hereafter), and the lat- 
ter was first presented by Cleve, Gottesman and Lo [Ij. 
Since the above pioneering works appeared, QSS has at- 
tracted a great deal of attention (please see [1, Q for the 
sharing of classical secret and 5] for that of quantum 
information) . 

As we know, the designing schemes and analyzing 
their security are two inherent directions of cryptogra- 
phy, which are opposite to but stimulate each other. 
Each of them is necessary to the development of cryp- 
tography. This is also the case in quantum cryptogra- 
phy 0, 0, H, [13, [HI- However, because the theory 
of quantum information remains still far from satisfacto- 
rily known, the development of quantum cryptanalysis is 
relatively slow, especially in QSS. In fact, it is complex 
to analyze the security of QSS protocols because multi- 
ple participants are involved and not all are honest, and 
therefore few results [H, [H, [l3| have been obtained. 

In this paper, we present a method to analyze the se- 
curity of QSS protocols taking the HBB scheme ^ as an 
example. The security of HBB has been discussed from 
several aspects. Ref. [i[ analyzed an intercept-resend at- 
tack by a dishonest participant and an entangle-measure 



attack by an external attacker. References [l3,[ilj[i3] in- 
vestigated the relation between security and the violation 
of some Bells inequalities by analyzing several eavesdrop- 
ping scenarios. However, their analyses are incomplete 
because not all the individual attacks are covered. Ref- 
erence 3 showed that the HBB scheme was insecure to 
a skillful attack, and gave a remedy; but this analysis 
is not systematic. Here, we consider the original HBB 
protocol and give a complete and systematic analysis of 
security against a participant attack. From our analysis 
we also get the same result as Ref. 0, and, moreover, 
we derive the necessary and sufficient (NAS) conditions 
for a successful attack, which is more important. From 
the NAS conditions, we can find many attack schemes 
easily (including the eavesdropping strategy in Ref. i), 
which will deal with the difficulty that breaking a pro- 
tocol is unsystematic. Although the result is partly not 
new [st], the method (which is indeed our main aim) is. 
This method might be useful for the analysis of other 
protocols. 

The paper is structured as follows. In Sec. II, we 
review the HBB protocol briefly. In Sec. Ill, we ana- 
lyze general participant attack strategies, and derive the 
NAS conditions under which a dishonest participant at- 
tains the whole secret without introducing any error. In 
Sec. IV, we give a simple scheme to achieve the attack 
successfully. Finally, we give a conclusion and discussion 
in Sec. V. Cumbersome computations and formulas are 
summarized in the Appendix. 



II. THE HBB PROTOCOL 

Let us introduce the principle of the HBB scheme [l| 
first. The dealer Alice wants to divide her secret mes- 
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TABLE L Correlations between Alice's, Bob's measurement 
results and Charlie's results. Alice's (Bob's) measurement 
results are listed in the first column (line). 



Alice/Bob 


x+ 


X 




y 


x+ 


x+ 


x~ 


y 


y^ 


x~ 


x~ 


x+ 




y 




y~ 




X 


x+ 


y 




y 


x+ 


x~ 



sage between her two agents, Bob, and Charlie. At the 
beginning, Alice prepares a sequence of GHZ triplets in 
the state (1/V2)(|000) + |111))asc, where the subscripts 
A, B and C denote the three particles for Alice, Bob and 
Charlie, respectively. For each triplet, Alice keeps parti- 
cle A and sends particle B to Bob and C to Charlie. As 
in the Bennett-Brassard 1984 scheme fl^ scheme, all the 
three parties choose randomly the measuring basis (MB) 
X OT y to measure their particles and then they publish 
their MBs. The announcement should be done in the 
following way: Bob and Charlie both send their MBs to 
Alice, who then sends all three MBs to Bob and Char- 
lie Note that no one can learn other's bases before 
having to reveal his, otherwise as pointed out in Ref. 
he could cheat more successfully. When the number of 
the parties who choose x is odd, the outcomes are use- 
ful. Thanks to the features of the GHZ state, Charlie 
and Bob can deduce the outcomes of Alice when they 
cooperate (see Table U ^,|). To check for eavesdropping, 
Alice chooses randomly a large subset of the outcomes 
to analyze the error rate. That is, Alice requires Bob 
and Charlie to announce their outcomes of the samples 
in public. If the error rate is lower than a threshold value, 
they keep the remaining outcomes as secret key. 

III. THE ATTACK ON THE HBB PROTOCOL 

Now let us give a complete discussion of the security 
of the HBB scheme. As pointed out in Refs. [13, [H, fl9| . 
a participant generally has more advantages in an at- 
tack than an outside eavesdropper in the secret-sharing 
protocols. If a QSS protocol is secure for a dishonest 
participant, it is secure for any eavesdropper. Therefore, 
to analyze the security, we should concentrate our atten- 
tion on participant attack. Without loss of generality, 
we assume the attacker is Charlie, denoted Charlie*. He 
seeks to learn Alice's secret himself without introducing 
any error during the eavesdropping check. In order to 



take advantage of Alice's and Bob's delayed information 
about their MBs, a wise attack strategy for Charlie* is 
as follows. When the qubits B and C are sent out by Al- 
ice, he lets an ancilla, initially in some state \x), interact 
unitarily with them (the dimensionality of the ancilla is 
a free variable which causes no loss in generality). After 
the interaction, Charlie* sends qubit B to Bob, stores 
qubit C and his ancilla until Alice announces the MBs 
used by the three parties. Finally, Charlie* measures the 
qubits at his site to achieve the secret according to Alice's 
announcements . 

We now describe the procedure in detail. After Alice 
sends out the two qubits, B and C, Charlie* intercepts 
them and they interacts with his ancilla. After that, the 
state of the whole system may be written as 

1 

|^')abcb = ^ aij\ij)AB\eij)cE, (1) 

i,j=0 

where \eij) refers to the state of Charlie* after the in- 
teraction and is normalized, and is complex number 
that satisfies 

E|a..f = l- (2) 

A. The conditions to escape detection 

As mentioned above, to use the information about 
Alice's and Bob's MBs, Charlie* does not measure his 
qubits until Alice reveals them, and then he can choose 
different methods accordingly. Note that when Alice re- 
quires Charlie* to declare his MBs, Charlie* generates a 
random sequence of x and y to forge his MBs, actually he 
does not measure any qubit. If the MBs chosen by all the 
three parties satisfy the condition that the number of x 
is odd, the results are kept, otherwise they are discarded. 
Therefore Charlie* knows Alice's and Bob's MBs for ev- 
ery useful triplet which can be utilized in the subsequent 
steps. When some triplets are chosen by Alice to detect 
eavesdropping, Charlie* then measures his corresponding 
qubits and announces outcomes according to Alice's and 
Bob's MBs. Now we explore the conditions they must be 
satisfied if Charlie* wants to escape from being detected. 

Let us first consider the case where both Alice and Bob 
measure their qubits in x direction, and of course, Char- 
lie* declares x. The state of the whole system \^)abce 
can be rewritten as 
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\'^)abce = 2 [ \x^)A\x^)B{aoo\£oo) + aoi|eoi) + aiokio) + aii|eii))c_B 

+ \x^)A\x')B{aoo\£oo) - aoikoi) + aiokio) - aiikii))cB (3) 

+ \x^)A\x^)B{aQQ\eQo) + aoi|eoi) - aio|eio) - aii|£ii))c£; 

+ \x^)A\x^)BiaQo\£oQ) - aoikoi) - aiokio) + aii\£ii))cE]- 



We can see from Table U that without eavesdropping, 
if AHce's and Bob's results are x'^x'^ or x~x~, Char- 
lie* 's announcement should be x'^ , otherwise, his an- 
nouncement should be x^ . In a convenient depiction, 
we denote Charlie*'s state as l^Pj^k") which is normal- 
ized, when Alice's and Bob's results are/" and fc", where 
j,k g {x,y} and m, n G {+,—}. To avoid being found 
out, Charlie* should have the ability to discriminate 
completely between the two sets {\fx+x+)T\^x-x-)}: 
{\fx+x-), \Vx-x+)}- As shown in Ref. [20|, two sets Si, 
S2 can be perfectly discriminated if and only if the sub- 
spaces they span are orthogonal. So the scalar products 
of Charlie* 's states have to satisfy four constraints: 

ifx+x+lfx + x-) = 0, 
^ {fx+x+\fx'x+)=0, 
{^x-x-\^x + x-) =0, 
. {"i^x-x- \'Px-x+) = 0. 

From Eqs. (3) and (4), we obtain 

aQQaoi(£oo|£oi) ~ aiiaio(eii|eio) = 0, 
^ aQQaio(£oo|£io) ~ anaoi (en |eoi) = 0, 

|aoiP - aoiaio(eoi|eio) + atoaoi(eio|eoi) - kioP = 0, 
. jaooP - aooaii(eoo|eii) + anaoo(eii|eoo> - kiiP = 0. 

Similarly, the constraints are then found in the Appendix 
for other cases. Finally, we obtain results from Eqs. (5), 
(A.3), (A.6) and (A.9) : 

aQQaoi(eoo|eoi) — aooaio(£oo|£io) — 0, 
000^11 (eookii) = aoiaio(£oi|£io) — 0, 
< aoiaii(£oi|£ii) = a|oaii(£io|eii) = 0, (6) 

|aoo| = |aii|, 
, |aoi| = |aio|. 

Obviously, Charlie* can succeed in escaping detection by 
Alice and Bob when his operations satisfy Eq. (6). 

B. The maximum information the attacker can 
attain 

After escaping from detection, Charlie* measures 
the remaining qubits to deduce Alice's secret. Now 
let us compute the maximum information that Char- 
lie* can gain. From Eqs. (3) and (6), we can see 
if Alice's result is x+, Charlie* 's state collapses to 
\y^x+x+) or \Vx+x-) with equal probability, otherwise 



collapses to \(Px'x+) or \ipx-x-) with equal probabil- 
ity. So to get information of Alice's result, a;+ or 
x~ , Charlie* should distinguish between two mixed 
states px+ = ^\iPx+x+){'Px+x+\ + ^\fx+x-){v'x+x-\ and 
Px- = ^\'Px~x+){'Px-x+\ + ^\'Px-x-){'Px-x-\ occurring 
with equal a priori probability. Generally, there are two 
ways to discriminate between two states, minimum er- 
ror discrimination and unambiguous discrimination. In 
Ref. [21], the authors showed the minimum failure prob- 
ability Qf attainable in unambiguous discrimination is 
always at least twice as large as the minimum-error 
probability Pe in ambiguous discrimination for two ar- 
bitrary mixed quantum states. So we should take the 
ambiguous discrimination to get the maximum informa- 
tion. Utilizing the well-known result 22]that to dis- 
criminate between two mixed states pi and p2 occurring 
with a priori probabilities pi and p2, respectively, where 
Pi +P2 = 1, the minimum-error probability attainable is 
-Pe = 5 - ^\\P2P2- PiPiW, where ||A|| ^TrVAU, we get 
the minimum-error probability to discriminate between 
Px+ and Px- under the constraints of Eq. (6) 

(5) -PiJ = ^(l-4|aoo|-|aio|). (7) 

Considering the other three cases (see the Appendix A) 
with similar strategy, we get the same results as Eq. (7). 

The mutual information between Alice and Charlie* in 
terms of Shannon entropy is given by 

I^^ = 1 + Pe log Pe + (1 - Pe) log(l - Pe). (8) 

Now the task is maximizing I^'^ with the constraints of 
Eqs. (2) and (6). Using the Lagrange multipher method, 
we attain the maximum I^^x = 1 under conditions 

(eookoi) = (eookio) = (eookii) = 0, 
(eoijeio) = (eoikii) = (eiokii) = 0, (9) 
|aoo| = |aoi| = |aio| = |aii| = 5. 

Now, we have the NAS conditions for a dishonest par- 
ticipant to attack HBB successfully. Therefore the HBB 
protocol is insecure (in its original form). Obviously, 
koo): koi), kio): and |£ii) are orthogonal to each other, 
which indicates that a dishonest participant need pre- 
pare one additive qubit at least. It is easy to verify that 
the eavesdropping strategy in Ref. Q is a special exam- 
ple of our results, where two additive qubits are used and 
aooleoo) - ^|000), aoi|£oi) = -i|001), aio|eio) = i|110), 
and aii|£ii) = — 
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FIG. 1: Quantum circuit representing the interaction of Char- 
lien's ancilla E, with qubits B, C. 



IV. AN EXAMPLE OF SUCCESSFUL ATTACK 

According to Eq. (9), we can construct some attack 
schemes easily. Here we give an even simpler scheme 
than Ref. [3] with only one additive qubit. Generally, the 
ancilla is the standard state |0). We choose aoo|£oo) = 
i|00), aoileoi) = 5IOI), aio|£io) = ||10), and anlen) = 
— ^|11) which satisfy Eq. (9). Comparing the initial 
state with the state after interaction (see Eq. (1)), we 
can derive the operations performed by Charlie*. 

Now we describe the attack orderly. Charlie* prepares 
the ancilla E in state |0). After Alice sends out two 
qubits B and C, Charlie* intercepts them, performs H — 
(|0)(0| + |1)(0| + |0)(1| - |l)(l|)/^/2 on the qubit B and 
CNOT operation on B, E (see Fig. [l]). The entangled 
state of Alice, Bob and Charlie* is converted from — 
^(|000) + |lll))Asc®|0)isto 
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1*1) = ^{mABmcE 



QI)ab\01)ce (10) 
+ |10)as|10)c£- |ll)Ai3|ll)cB). 



After Alice and Bob measure their qubits, the whole sys- 
tem is changed into |5'2) (see Fig. [5] and Fig. [3]) which 
varies according to their MBs. Let us describe all the 
cases in detail. 

(i) If both Ahce's and Bob's MBs are x, Charlie* 's 
state collapses to one of the four results 



(11) 



^x+x+) 


= ^(|00) + 


101)- 


f |io) - 


|ll))ciJ, 


Vx+x-) 


= i(|00)- 


101)- 


f |10) + 


|ll))ciJ, 


fx-x+) 


= ^(|oo> + 


101)- 


- |io> + 


|ll))ci;, 


Vx-x- 


= ^(|00)- 


101) 


- |io) - 


|ll))cij 



(ii) When Alice and Bob measure their qubits in x, y 
basis, respectively, Charlie* 's state may be one of the 
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Alice's, Bob's Operations Charlie*' Operations 

FIG. 2: Quantum circuit on the detection qubits. Here U , V, 
We {H,SH}, and S = |0){0| The 'meter' symbol 

denotes a projective measurement in the computational basis 
z. H (SH) can transform z basis into x (y) basis. Charlie* 
performs his operations according to the MBs of Alice and 
Bob to avoid being detected. 



four states 
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= ^(|oo) + 




-|10)- 


*|ll))c£, 


\^x-y+) 


= ^(|00)- 
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^\ll))cE, 


\Vx-y- 


= ^(|00)4 
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(12) 



(iii) When Alice and Bob measure their qubits in y, x 
basis, respectively, Charlie* 's state may be one of the 
four states 



(13) 



Vy+x+) 


= ^(|00) + 


101) 


-z|10) + 


A^I))CE, 


^y+x-) 


= ^(|00)- 


101) 


-z|10)- 


A^I))CE, 


'Py-x+) 


= ^(|00) + 


101) 


+ z|10) - 


A^I))CE, 


Vy-x- 


= ^(100) - 


101) 




-^\ll))cE 



(iv) When Alice's and Bob's MBs are y., Charlie*'s state 
collapses to one of the four results 



(14) 



(Py+y+) 


= i(|00)-.|01) 


~i\lO) + 


\n))cE, 


^y+y-) 


= i(|00)+*|01) 


-*|10)- 


\n))cE, 


^y-y+) 


= 1(100) -*|01) 


+ i\lO) - 


\n))cE, 


\Vy-y-] 


= i(|00)-t-z|01) 


+ i\lO) + 


|11))CB 



It is easy to validate that the four states are orthogo- 
nal to each other in every case, which implies that they 
can be distinguished perfectly. Consequently, Charlie* 
can not only get the secret of Alice but also escape from 



5 







u 

V 
































' A 








1 u 







Alice's, Bob's Operations Charlie*' Operations 



FIG. 3: Quantum circuit on the information qubits. After 
Alice and Bob measure their qubits, Charhe* measures qubit 
C in the same basis as Ahce, and qubit E in computational 
basis. He can deduce Ahce's results from his measurement 
outcomes. 



TABLE II: The unitary operators for (/, V, W in different 
cases. 
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ii 
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iv 
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SH 


SH 
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SH 
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SH 
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H 


SH 


SH 


H 



TABLE III: Relations between Charlie*'s measurement re- 
sults and his announcements (the first column) for the detec- 
tion qubits. 





i 


ii 


iii 


iv 





10, 01 


10, 11 


10, 01 


10, 11 


1 


00, 11 


00, 01 


00, 11 


00, 01 



states in Eq. (11) arc changed into 



detection. In fact, we only need distinguish between two 
different results because the qubits are used to either de- 
tect eavesdropping or distill information. Therefore there 
are some simple ways to fulfill Charlie* 's objective. 

We take case (i) as an example to describe Charlie*'s 
operations. Let us first explain how Charlie* can escape 
from being detected when the qubits are chosen to check 
eavesdropping. Charlie* wants to deduce his proper dec- 
laration or ; therefore, he need discriminate be- 
tween {\'^x+x+),Wx-x-)} and {\<^x+x-),Wx-x+)}- A 
particularly simple circuit to achieve this task is illus- 
trated in Fig. El (Here U ^ V = W = H). Concretely, 
after the operations of CNOT and FF, the four states in 
Eq. (11) are converted into 



\^x+x^) = -j=m) + m)cE, 



Wx+a 
Wx-a 

Wx-x- 



= — (|00)-|ll))cB, 
= i=(|00) + |ll))cB, 

.-^(-|01) + |10))ci=;. 



(15) 



Then Charlie* measures each qubit in computational ba- 
sis. If the measurement results of C, E are 00 or 11, 
Charlie* 's announcement is 1 (corresponding to |1), 
or |?;~) hereafter), otherwise his announcement is (cor- 
responding to |0), Ix"*") or |y+) hereafter). According to 
Table m we can see no error occurs, and therefore Char- 
lie* can escape from being detected. 

We now discuss how Charlie* can obtain the secret 
information from his qubits. He only needs distinguish 
between {Wx+x+) AVx+x-)} and {\<^x-x+) A'4^x-x-)} to 
get Alice's secret a;"*" or x~ . The circuit to achieve this 
task is illustrated in Fig. [31 After the U operation, the 



Wx+x + 






\^X+X~ 1 






Wx'x+i 






Vx-x-) 




-|10))ci! 



(16) 



From Eq. (16), we can see clearly that the measurement 
results, 01 or 10, imply that Alice's secret is a;~, and 00 
or 11 indicate x'^ . 

For other cases (ii), (iii) and (iv), Charlie* can also 
distinguish between the corresponding states by choosing 
different U and W according to Table [Hi avoid being 
detected by announcing his results according to Table Hill 
and then deduce Alice's secret according to Table HVl 



V. CONCLUSION AND DISCUSSION 

The object of QSS protocols is to transmit a secret in 
such a way that only the authorized groups can access 
it, and no other combination of parties can get any in- 
formation about it. The worst case for QSS protocols 
is that some participants are dishonest, and try to find 
the secret by themselves. Therefore, participant attack is 
the most serious threat for the security of QSS protocols, 
and that is exactly what we study. The purpose of this 



TABLE IV: Relations between Charlie*'s measurement re- 
sults and Alice's secret (the first column) for the information 
qubits. 





i 


ii 


iii 


iv 





00, 11 


00, 11 


10, 01 


10, 01 
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10, 01 


10, 01 


00, 11 


00, 11 
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paper is to give a method to analyze a participant at- 
tack in QSS. We introduce this method taking the HBB 
scheme [l| as an example. A dishonest participant inter- 
cepts all the qubits, they interact with his ancilla, and 
he then resends them out. He then measures his qubits 
after other participants reveal their useful information. 
By discriminating between two mixed states, we obtain 
the NAS conditions under which the dishonest partici- 
pant can attain all the information without introducing 
any error. This result shows that the HBB protocol is in- 
secure (in its original form). Finally, we give an example 
achieving the proposed attack to demonstrate our results 
further. 

Although the result that the HBB scheme is insecure 
(in its original form) is not new, the method of analyz- 
ing the participant attack is, to our knowledge. The 
treatment we have presented appears to cover all indi- 
vidual participant attacks allowed by physical laws. This 
method can be applied to other similar QSS protocols 
with some modifications. We believe that this method 
would be useful in designing related schemes and analyz- 
ing their security. On the one hand, we can construct 
attack strategies easily according to the NAS conditions 
when a protocol has security loopholes. On the other 
hand, we can show that protocol is secure if the attack 
conditions cannot be reached. For example, applying this 
method to the enhanced protocol we can show it is 
secure (Such analysis is beyond the scope of this paper) . 
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APPENDIX A: CONSTRAINTS ON CHARLIE*'S 
PROBES 



ABCE 



-[|a::+?;+)(aoo|eoo) - iaoi|£oi) + aio|£io) - iaii|eii)) 

+ |x+?/")(aoo|£oo) + ^floikoi) + aiokio) + «aii|eii)) 
+ |x"y+)(aoo|£oo) - «aoi|£oi) - aiokio) + iaiikii)) 
+ |x"y")(aoo|£oo) + jaoi|£oi) - aiokio) - «aii|£ii))]. 

(Al) 

According to Table HI when Alice's and Bob's results are 
or x^y~, Charlie* 's announcement should be y~ , 
otherwise, his announcement should be Therefore, 
Charlie* should be capable of distinguishing between the 

two sets, {\(Pa: + y+),\'Px-y-)} and {\^a: + y-),\'Px-y+)}, tO 

avoid being detected. That is 



i'^x+y+l'^x+y-) = 0, 

{(Px+y+\<fx-y+) = 0, 

(y^x-y-lfx + y-) = 0, 

. {y^x-y-\'Px-y+) = 0. 

Then we get 

aoo'^oi(£oo|£oi) + aiiaio(£ii|£io) = 0, 
Cfoo'^io(£oo|£io) — aiiaoi(£iikoi) = 0, 
|aoiP - «aQiaio(£oi|eio) - ialoaoi (eiokoi) 
|aooP + «aooaii(eoo|eii) + «aiiaoo(£ii|£oo) 



(A2) 



(A3) 
- laioP =0, 
-|aiip=0. 



(2) When Alice, Bob and Charhe* choose the MBs y, x, 
y, respectively, \^) abce can be rewritten as 



\'^)abce = 

i[|y+x+)(aoo|£oo) + aoikoi) - iaio|£io) - «aii|£ii)) 

-|-|y+a;")(aoo|£oo) - ooikoi) - «aio|£io) + «aii|£ii)) 
+ l2/"a;+)(aoo|£oo) +aoi|£oi) +mio|£io) +iaii|£ii)) 
+ l2/"a^")(aoo|£oo) - aoi|£oi) + iaio|£io) - mii|£ii))]. 

(A4) 

According to Table [H the results, y^x^ or y^x^ , imply 
Charlie* 's announcement should be y", and others imply 
y^ . For the same reason, we let 



i^y+x+l'^y+x-) = 0, 
{(Py+x+\y^y-x+) = 0, 
{•^y-x-lfy + x-} = 0, 
. {fy-x- \Vy-x+) = 0. 



(A5) 



We then have 



In this appendix, we find the conditions which Char- 
lie* 's operations need satisfy when no errors are to occur 
in the procedure of detection in other three cases. 

(1) When Ahce, Bob and Charlie* choose the MBs 
X, y, y respectively, the whole system \'^)abce can be 
rewritten as 



'^oo'^oi(£oo|£oi) ~ a2]^aio(£ii|£io) — 0, 
'^oo'^io(£oo|£io) + aiiaoi(£ii|£oi) — 0, 
|aoiP + «aSiaio(£oi|£io) + «aioaoi(£io|£oi) 
|aoo|^ + iaooaii(£oo|eii> + ialiaoo{eii\eoo) 



laior =0 



= 0. 

(A6) 
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(3) When Alice, Bob and Charlie* choose the MBs y, 
y, X, respectively, \'^)abce can be rewritten as 



We then have 



ABCE 



-j[\y y ){o-oo\^oo) - iaoikoi) - iaiokio) - aii|£ii)) 

+ |y^2/~)(aookoo) + Jaoikoi) - ioiokio) + aii|£ii)) 
+ |y"y^>(«oo|£oo> - «aoi|eoi) + joio|eio) + aii|eii)) 
+ \y^y^ ){aoo\£oo) + iaoi|eoi) + mio|£io) - aiikii))]- 

(A7) 

The results, y^y^ or y^y^, imply Charlie*'s announce- 
ment should be x~, and others imply a;+. For the same 
reason, we let 



'2oo'^oi(£oo|£oi) + a^]^aio(eii|eio) — 0, 
oioo^io(s^oo|eio) + a*iaoi(s^ii|£oi) = 0, 



(A9) 



\aoi\ - aoiaio(eoi|eio) + atoaoiieioleoi) - kioP = 0, 
|aoo|^ + ciSo«ii(^ookii) - anaoo(£ii|eoo) - |aii|^ = 0. 



i^Py+v+lfy+v) 

{Vy+y+\^y-y+) 

i'Py-y-lVy+y-) 
{'Py-y-\Vy-y+) 



0, 
0, 
0, 

:0. 



(A8) 
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